Artifact updates

Android

Android Call Logs (UFED Agent)

Call logs

Google Maps

Outlook

ProtonMail

Signal

Slack

Snapchat

Textfree

WeChat Messages

Windows

Safari Downloads

Safari iCloud Tabs

Rebuilt Desktops

Refined Results

Web Chat URLs

iOS - Biome

Biome App Intents NEW

Apple Maps
Facebook Messenger
Instagram Direct Messages
iMessage/SMS/MMS
iOS Call Logs
Signal
Siri
Snapchat
Weather
WhatsApp

CarPlay Recently Used Apps NEW

Device Screen Backlight States NEW

macOS - Biome

Application Focus NEW

Application Launch NEW

Device Plugged-In States NEW

Device Screen Backlight States NEW

macOS

Network Usage

Outlook

Safari Downloads

Safari iCloud Tabs

Safari Last Session NEW

Volume Information

iOS

Call Logs

Device Information

DuckDuckGo Bookmarks NEW

Edge Chromium Web History

LINE Messages

Outlook

Safari iCloud Tabs

Safari Last Session NEW

Signal

Slack

Snapchat

Textfree

TextMe Calls

TextMe Conversations NEW

TextMe Messages

TextNow

Tinder

Comae plug-in for supported Windows dump file analysis

Faster analysis of dump files without having to select a memory profile.
Perform YARA rules scans on memory images.
Support for Windows 11 machines.
64bit dump file support.

Privileged content exclusion and tagging

Use keyword lists to exclude matches from the Artifacts explorer, or to tag artifacts for review in AXIOM Examine.

Shared Agent Configuration

Multiple cyber workstations can now manage single or multiple endpoints with the use of shared agents.

Export related messages and attachments to load files

When exporting a load file, if you've included emails or files that were recovered as email attachments, you can now allow AXIOM Examine to automatically export related files. Select this option to allow for the following:

If you've included an email, all attached files are included.
If you've included an attachment, the parent email and all sibling attachments are included.

Performance improvements in AXIOM Examine

Performance improvements implemented across AXIOM Examine include:

Faster loading in thumbnail view and conversation view.
Faster initial loading and filtering in Artifacts explorer.
Faster exporting.
Faster case opening.

Note that many factors can influence performance, such as hardware and case size. The improvements listed above generally appear more significant in lager cases.

See relevant data when viewing multiple artifacts in the Artifacts explorer

When you view multiple artifacts at once in the Artifacts explorer, AXIOM Examine now displays a key detail, supporting detail, and additional detail. These details appear depending on what is commonly most relevant for each artifact. For example, an email artifact might display the sender, recipient, and message body, whereas a document might display the file name, file size, and author.

Export tags and comments to Magnet REVIEW

When you create an export for Magnet REVIEW, you can now include tags and comments from your AXIOM case.

Search for CSAM content using Thorn's robust AI models

Magnet Forensics has partnered with Thorn to help you track down CSAM content in your cases. In addition to the default Magnet.AI models, you can integrate Thorn to make use of their AI models, which are trained using a more robust data set.

Thorn integration is available to law enforcement only. To learn more about Thorn, see their website: https://www.thorn.org/

Artifacts

Android Call Logs (UFED Agent) | Android: Updated parsing support to improve the call duration and end time fragments.
Apple Maps - Biome App Intents | iOS: Added parsing support for Apple Maps - Biome App Intents.
Biome Application Intents | iOS: Added parsing support for Biome Application Intents.
Biome Application Focus | macOS: Added parsing support for Biome Application Focus.
Biome Application Launch | macOS: Added parsing support for Biome Application Launch .
Biome Device Plugged-In States | macOS: Added parsing support for Biome Device Plugged-In States.
Biome Device Screen Backlight States | iOS, macOS: Added parsing support for Biome Device Screen Backlight States.
Call Logs | Android,iOS: Updated parsing and carving support to include the timestamp and duration.
CarPlay Recently Used Applications | iOS: Added parsing support for CarPlay Recently Used Applications.
Device Information | Android: Updated parsing support to recover home and lock screen wallpapers.
Device Information | iOS: Updated parsing support to recover whether a timezone was set automatically by the device or selected by the user.
DuckDuckGo Bookmarks | iOS: Updated parsing support to recover data from the latest version. [v7.71.0]
Edge Chromium Web History | iOS: Updated parsing support to recover data from the latest version. [Edge v104.1293.63, iOS 14]
Facebook Messenger - Biome App Intents | iOS: Added parsing support for Facebook Messenger - Biome App Intents.
Google Maps Saved Locations | Android: Updated parsing support and added carving support to recover additional timestamp, latitude, and longitude data.
Instagram Direct Messages - Biome App Intents | iOS: Added parsing support for Instagram Direct Messages - Biome App Intents.
iOS Call Logs - Biome App Intents | iOS: Added parsing support for iOS Call Logs - Biome App Intents.
iOS iMessage/SMS/MMS - Biome App Intents | iOS: Added parsing support for iOS iMessage/SMS/MMS - Biome App Intents.
iOS WhatsApp - Biome App Intents | iOS: Added parsing support for iOS WhatsApp - Biome App Intents.
LINE Messages | iOS: Updated parsing support to recover videos from temp folders. [v12.17.1]
Network Usage | macOS: Added parsing support for Network Usage on macOS.
Outlook Emails | Android, iOS, macOS, Windows: Updated parsing support to recover date/time fragments that reflect those in the original application: received, sent, created, and modified.
ProtonMail Emails | Android: Updated parsing support to recover data and attachments from the latest version. [v3.0.1]
Rebuilt Desktops | Windows: Updated support to include the updated icons, taskbar, and registry path for Windows 11.
Safari Downloads | macOS, Windows: Updated parsing and carving support to recover missing hits and to show correct values for file sizes.
Safari iCloud Tabs | iOS, macOS, Windows: Updated carving support for Safari iCloud Tabs.
Safari Last Session | iOS, macOS: Added parsing support for Safari Last Session.
Signal - Biome App Intents | iOS: Added parsing support for Signal - Biome App Intents.
Signal Conversations | Android: Updated parsing support to recover data from the latest version. [6.10.9]
Signal Groups | Android: Updated parsing support to recover the latest version. [v6.10.9]
Signal Messages | Android: Updated parsing support to recover backups and other data from the latest version. [v6.10.9]
Signal Messages | iOS: Updated parsing support to recover attachments in the latest version. [v2.36.1]
Signal Stories | iOS: Updated parsing support to remove duplicate location information.
Siri - Biome App Intents | iOS: Added parsing support for Siri - Biome App Intents.
Slack Channels | iOS: Updated parsing support to recover data from the latest version. [Slack v22.10.20, iOS 14]
Slack Users | Android: Updated parsing support to recover missing data. [v22.9.10.0, v23.2.30.0]
Snapchat - Biome App Intents | iOS: Added parsing support for Snapchat - Biome App Intents.
Snapchat Chat Messages | Android: Updated parsing support to recover direct replies to stories. [v12.20.0.33]
Snapchat Chat Messages | iOS: Updated parsing and carving support to recover missing hits.
Snapchat Chat Messages | iOS: Updated parsing support to recover most recent messages. [v12.19]
Snapchat Stories | Android: Updated parsing support to recover the user name. [v12.20.0.33]
Telegram Messages | Android: Updated parsing support to recover the message partner user ID when the user name is unavailable, and to recover the original file name of an attachment.
Textfree Groups | Android: Updated parsing support to recover the latest version. [v12.14]
Textfree Messages / Calls | Android, iOS: Updated parsing and carving support to improve consistency of fragment names with other messaging artifacts.
Textfree Messages / Calls | iOS: Updated parsing and carving support to improve the way incoming message data is reported.
TextMe Calls | iOS: Updated parsing support to correctly report the direction of a call. [TextMe v3.34.1, iOS 14]
TextMe Conversations | iOS: Added parsing support for TextMe Conversations.
TextMe Messages | iOS: Updated parsing support to include chat thread capability.
TextMe Messages | iOS: Updated parsing support to recover sender and recipient data. [v3.34.13]
TextNow Groups | iOS: Updated parsing support to recover the group name. [TextNow v22.41.0, iOS 14]
Tinder Messages | iOS: Updated parsing support to allow chat threading. [v13.18.0]
Volume Information | macOS: Updated parsing support to include macOS 13.
Weather - Biome App Intents | iOS: Added parsing support for Weather - Biome App Intents.
Web Chat URLs | Refined Results: Updated parsing support to classify Zoom data in a more user-friendly way.
WeChat Messages | Android: Updated parsing support to include local user and remove some obsolete fragments.
WhatsApp | iOS: Updated parsing support to pull contact names from the WhatsApp database before the device's contacts. [v22]

Remote acquisition

Multiple cyber workstations can now manage and acquire an endpoint using shared agents.

Cloud

Improvements to Box.com acquisitions to prevent throttling issues.
Updated the AXIOM Cloud Authenticator extension for Google Chrome to prevent installation in the Personal profile.

Processing

AXIOM now supports loading RAR5 images that do not have a CRC (Cyclic Redundancy Check).
AXIOM Process now supports the RDSv3 hash database for excluding non-relevant files.
Comae is now available as an additional option for performing Windows memory dumps analysis.
The Flash Cookies artifact is now turned off by default in AXIOM Process.
You can now exclude or tag privileged content using keyword lists.

Examining

Various performance improvements to AXIOM Examine when viewing large cases, including faster case opening, faster loading in certain areas, and faster exporting.
When creating an export for Magnet REVIEW, you can now include tags and comments from your AXIOM case.
When viewing evidence from multiple different artifacts in the Artifacts explorer, AXIOM Examine now shows a key, supporting, and additional detail, depending on what is commonly most relevant for each artifact.
When you select a new encoding type for an Outlook Email, the new encoding will be correctly applied to the body of the email.
The email explorer now supports additional email artifacts. Data for these new artifacts appears in a flat folder structure.
The email explorer now supports EML(X) files.
The email explorer now supports the Outlook Webmail Inbox artifact.
The Last Modified Date/Time is now included for Outlook emails in PST exports.
When you include an item with text content in a load file export, such as a social media post, the text content will be included as a text file in the export.
You can now create separate .msg files for each Apple Mail email when you export to Excel. You can also export Apple Mail artifacts to PST.

Data enrichment and analytics

Improvements to the error messaging for Hash Sets Manager hash sets in AXIOM Process.
You can now integrate Thorn AI models for child abuse and nudity, to use in addition to the default Magnet.AI models.

Bug fixes

Previously, duplicate entries in the manifest would cause a iOS backup decryption failure. -ENGN-1104
Regular expression searches would only include string text. Now, these searches will also include numeric content. -EXM-1925
Sometimes, exports from AXIOM Examine to Magnet REVIEW would fail. -EXM-2078
Sometimes, Excel exports would fail if they included emails with a large number of characters, between 32761 and 32766. -EXM-2049
Fixed a number of exception errors that were found when recovering data from the following artifacts: -CARS-174
- Apple Keychain Internet Passwords | iOS, macOS
- Call Logs | iOS
- Edge | Windows
- Google Accounts | Android
- Google Drive
- Google Hangouts | Android
- Internet Explorer | Windows
- KakaoTalk Chat | Android
- Microsoft Office | Windows
- Pictures
- Rebuilt Desktops | Windows
- Snapchat | Android
- TextMe Calls | Android
- TextMe Messages | Android
Picture thumbnails that were acquired from ithmb files were being hashed incorrectly. -CARS-321
Results were missing when Microsoft Teams data was acquired from a Windows source. -CARS-322
Some Windows Rebuilt Desktops weren't built properly due to some files from the Windows Registry not being recovered correctly. -CARS-318
Sometimes, AXIOM Process froze when trying to scan an INFO2 file. -CARS-356
Sometimes, iOS Snapchat Group Members wasn't being properly recovered and resulted in an error. -MARS-993
Sometimes, Snapchat Messages data wasn't being recovered. -MARS-920
Sometimes, the receiver of a call from WhatsApp Messages was being reported incorrectly. -MARS-950
Sometimes, Tumblr Chat Messages were duplicated and reported an incorrect recipient. [v26.6.0] -MARS-807
The call duration was appearing incorrectly for iOS LINE Messages. [v12.19.0] -MARS-487
The device's IMEI wasn't always being recovered for iOS Device Information. -MARS-916
The directions of some iOS TextMe messages were being incorrectly reported. -MARS-975
The recipient fragment for the Textfree Messages artifact was incorrectly including the sender. -MARS-958
The User Accounts refined results artifact was incorrectly displaying iOS Apple Accounts account type and was omitting the account ID. -MARS-902
Known and non-relevant hashes uploaded to Hash Sets Manager in upper case were not matched correctly in AXIOM. -DEA-2935
Sometimes, an exception would occurr during Magnet.AI categorization, which would prevent it from completing. -DEA-2936
Previously, AXIOM Process may have failed to acquire a Facebook profile stating the file already exists. -CA-6
Previously, if Instagram Public acquisition is interrupted Process would crash without any artifacts. Now, an error is logged and partial hits are captured. -CA-982
Previously, Instagram Public acquisitions may have failed with an unauthorized error. -CA-920
Updated parsing of Instagram warrant returns. -CA-496

Known issues

To search for information about known issues, visit the knowledge base at support.magnetforensics.com.